[Cerowrt-devel] open recursive DNS server

[Cerowrt-devel] open recursive DNS server

[Michael Richardson]

I noticed that I'm being used as an open recursive relay.
I see:

except-interface=ge00

in the generated /var/etc/dnsmasq.conf, but that's wrong.  It should except
pppoe-storm from service!

Can I fix this somewhere in /etc/config?  Can I just put in a CIDR?

-- 
]               Never tell me the odds!                 | ipv6 mesh networks [ 
]   Michael Richardson, Sandelman Software Works        | network architect  [ 
]     mcr@sandelman.ca  http://www.sandelman.ca/        |   ruby on rails    [ 
	

Re: [Cerowrt-devel] open recursive DNS server

[Dave Taht]

hmm. you should still have been firewalled off. Is it really
responding to dns queries from the
outside world?

Add to /etc/config/dhcp

 list notinterface 'yourotherinterface'

there are other ways.

On Tue, Nov 25, 2014 at 10:25 AM, Michael Richardson <mcr@sandelman.ca> wrote:
>
> I noticed that I'm being used as an open recursive relay.
> I see:
>
> except-interface=ge00
>
> in the generated /var/etc/dnsmasq.conf, but that's wrong.  It should except
> pppoe-storm from service!
>
> Can I fix this somewhere in /etc/config?  Can I just put in a CIDR?
>
> --
> ]               Never tell me the odds!                 | ipv6 mesh networks [
> ]   Michael Richardson, Sandelman Software Works        | network architect  [
> ]     mcr@sandelman.ca  http://www.sandelman.ca/        |   ruby on rails    [
>
> _______________________________________________
> Cerowrt-devel mailing list
> Cerowrt-devel@lists.bufferbloat.net
> https://lists.bufferbloat.net/listinfo/cerowrt-devel



-- 
Dave Täht

thttp://www.bufferbloat.net/projects/bloat/wiki/Upcoming_Talks

Re: [Cerowrt-devel] open recursive DNS server

[Michael Richardson]

Dave Taht <dave.taht@gmail.com> wrote:
    > hmm. you should still have been firewalled off. Is it really responding
    > to dns queries from the outside world?

yes.... mind you I have routeable IP(v4)s addresses which are used to NAT
internal hosts to, and both those and the ppp interface respond...

    > Add to /etc/config/dhcp

    >  list notinterface 'yourotherinterface'

    > there are other ways.

Can I list more than one interface to ignore?  I'd rather list both the
underlying "ge00" interface (which was already there), and the pppoe-XXXX
interface.

-- 
]               Never tell me the odds!                 | ipv6 mesh networks [ 
]   Michael Richardson, Sandelman Software Works        | network architect  [ 
]     mcr@sandelman.ca  http://www.sandelman.ca/        |   ruby on rails    [ 
	

Re: [Cerowrt-devel] open recursive DNS server

[Dave Taht]

On Tue, Nov 25, 2014 at 6:54 PM, Michael Richardson <mcr@sandelman.ca> wrote:
>
> Dave Taht <dave.taht@gmail.com> wrote:
>     > hmm. you should still have been firewalled off. Is it really responding
>     > to dns queries from the outside world?
>
> yes.... mind you I have routeable IP(v4)s addresses which are used to NAT
> internal hosts to, and both those and the ppp interface respond...
>
>     > Add to /etc/config/dhcp
>
>     >  list notinterface 'yourotherinterface'
>
>     > there are other ways.
>
> Can I list more than one interface to ignore?  I'd rather list both the
> underlying "ge00" interface (which was already there), and the pppoe-XXXX
> interface.

it is a list. add as many list lines as you like.

>
> --
> ]               Never tell me the odds!                 | ipv6 mesh networks [
> ]   Michael Richardson, Sandelman Software Works        | network architect  [
> ]     mcr@sandelman.ca  http://www.sandelman.ca/        |   ruby on rails    [
>
>
>



-- 
Dave Täht

thttp://www.bufferbloat.net/projects/bloat/wiki/Upcoming_Talks